BackdoorDiplomacy: A Detailed Analysis of a Chinese APT Group
Introduction
BackdoorDiplomacy is a well-known Advanced Persistent Threat (APT) group that has been active since at least 2010. The group is believed to be based in China and has been linked to a number of cyber espionage campaigns targeting government and diplomatic entities across North America, South America, Africa, and the Middle East. The group is also known by several other names such as APT15, KeChang, NICKEL, and Vixen Panda.
BackdoorDiplomacy is known for its use of sophisticated tactics and techniques to infiltrate targeted networks and evade detection. The group has been found to use a combination of both open-source and custom-built tools to conduct its operations. The group has been observed using various types of malware, including backdoors, implants, and trojans, to gain a foothold in targeted networks.
One of the key characteristics of BackdoorDiplomacy is its focus on remaining undetected for extended periods. The group has been known to use a range of techniques to evade detection, including the use of living-off-the-land tactics, which involve using existing binaries, scripts, or libraries that are already present on a target system. This approach enables the group to avoid detection by modern prevention security controls and allows it to remain active within a targeted network for an extended period.
BackdoorDiplomacy has been linked to a number of high-profile attacks in recent years. In June 2021, Slovak cybersecurity firm ESET reported on intrusions mounted by the group against diplomatic entities and telecommunications companies in Africa and the Middle East using a custom implant known as Turian. In December 2021, Microsoft announced that it had seized 42 domains operated by the group in its attacks targeting 29 countries. The group has been linked to a new wave of attacks targeting Iranian government entities between July and late December 2022.
Overall, BackdoorDiplomacy is a highly sophisticated and well-funded APT group that poses a significant threat to government and diplomatic entities across the globe. The group's focus on remaining undetected for extended periods and its use of sophisticated tactics and techniques make it a formidable adversary that requires advanced detection and response capabilities to protect against.America, Africa, and the Middle East.
KeChang, Nickel and Vixen Panda.
Tactics, Techniques, and Procedures (TTPs)
BackdoorDiplomacy has been known to use a variety of different TTPs in its cyber espionage campaigns. Some of the most commonly used TTPs associated with the group include:
Indicators of Compromise (IOCs)
BackdoorDiplomacy has been known to use a variety of different tools and techniques to compromise its targets. Some of the known IOCs associated with the group include:
IOCs associated with BackdoorDiplomacy's Turian Backdoor
Turian is a custom implant used by BackdoorDiplomacy in its intrusions against diplomatic entities and telecommunication companies in Africa and the Middle East. The implant allows for remote access into targeted networks and is under active development by the group.
领英推荐
IOCs for NPS Proxy Tool:
The NPS proxy tool is a custom-built tool that is used by BackdoorDiplomacy for reconnaissance and lateral movement. The following are the known IOCs associated with this tool:
Command line arguments: "nps.exe -r host -t Port -u User -p Pass"
IOCs for IRAFAU Backdoor:
The IRAFAU backdoor is a custom-built tool that is used by BackdoorDiplomacy for remote access and control of the compromised systems. The following are the known IOCs associated with this tool:
IOCs for Quarian Backdoor:
Quarian is a custom-made remote access trojan (RAT) used by BackdoorDiplomacy in attacks targeting the Middle East. It is a predecessor of Turian and allows for a point of remote access into targeted networks.
IOCs for Other Tools:
Conclusion
BackdoorDiplomacy is a Chinese APT group that has been active since at least 2010. The group is known for its cyber espionage campaigns targeting government and diplomatic entities across North America, South America, Africa, and the Middle East. The group is known to use a variety of different tools and techniques to compromise its targets, including supply chain attacks, living-off-the-land, custom malware, and advanced reconnaissance. Businesses and organizations should be aware of the group's TTPs and implement security controls to detect and defend against BackdoorDiplomacy's attacks.